CVE-2023-39240: ASUS RT-AX55、RT-AX56U_V2 - Format String - 3
It is identified a format string vulnerability in ASUS RT-AX56U V2’s iperf client function API. This vulnerability is caused by lacking validation for a specific value within its setiperf3cli.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.
Other sources
It is identified a format string vulnerability in ASUS RT-AX56U V2’s iperf client function API. This vulnerability is caused by lacking validation for a specific value within its setiperf3cli.cgi module. An unauthenticated remote attacker can exploit this vulnerability without privilege to perform remote arbitrary code execution, arbitrary system operation or disrupt service.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID for this format string vulnerability in ASUS RT-AX56U V2’s iperf client function API?
The vulnerability ID is CVE-2023-39240.
What is the severity rating of CVE-2023-39240?
The severity rating of CVE-2023-39240 is 9.8 (Critical).
How does this vulnerability affect ASUS RT-AX55?
ASUS RT-AX55 is not vulnerable to CVE-2023-39240.
How does this vulnerability affect ASUS RT-AX56U V2?
ASUS RT-AX56U V2 with firmware version 3.0.0.4.386_50460 is affected by CVE-2023-39240.
What is the recommended action to fix CVE-2023-39240?
Apply the latest firmware update (version 3.0.0.4.386_50460) from ASUS for RT-AX56U V2 to fix the vulnerability.